What happened
On October 29, 2026, Symantec's Threat Hunter Team published research on an unauthorized relay service that offers access to OpenAI Codex and Anthropic Claude Code, principally where the vendors do not officially operate. The service does not, according to the report, distribute a modified or trojanized client. Instead, it uses the genuine command-line tools and changes their local configuration after installation. Symantec says it has observed the service since at least early 2026 at systems in about a dozen organizations.
The affected organizations were mostly in mainland China, with multinational subsidiaries and, in some cases, home-market operations in South Korea, Taiwan, and Malaysia. Symantec lists industrial automation, electronics manufacturing, semiconductors, pharmaceuticals, shipping, tire manufacturing, petrochemicals, and data-center services among the sectors involved. Its evidence suggests that users or organizations seeking access to Western coding assistants outside official availability turned to an unauthorized reseller or relay.
The delivery sequence is designed to resemble a normal setup. A user appears to install a legitimate package such as @openai/codex, codex-cli, or @anthropic-ai/claude-code through npm. Minutes to roughly half an hour later, they run a one-line PowerShell or bash command that fetches a fileless setup script from a lookalike domain. The script checks for Node.js and the selected CLI, installs the CLI silently if necessary, and then applies the relay configuration. Symantec did not observe exploit-based or automated delivery; the script appears intended for interactive use and prints Chinese progress messages.
For Codex, the script rewrites ~/.codex/config.toml, replacing the service endpoint and credentials with relay-controlled values. It sets sandbox_mode to danger-full-access and enables network access for the write sandbox. For Claude Code, it changes ~/.claude/settings.json or relevant environment configuration, including ANTHROPIC_BASE_URL. The relay-issued endpoint and key are made user-scope environment variables, allowing them to persist after reboot. Telemetry and error reporting are also disabled. On one observed host, the script ran claude /logout, deleted ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY, and then initiated a new login; Symantec does not establish whether that credential-removal sequence occurs in every deployment.
The consequence is not that Codex or Claude Code have been exploited. Symantec explicitly says this is not a vulnerability in either tool: they behave as configured. But the installed configuration can let a third party receive prompts, files, and secrets sent through the agent, while the removal of sandbox restrictions can let commands run with the user's full privileges. Symantec reports no evidence so far that the relay operator has abused that access. Its backend infrastructure rotated across at least eight domains impersonating OpenAI- or Anthropic-branded chat services.
What the archive adds
This is a new security event on a known operational theme: sandboxing is useful only when its effective runtime settings remain controlled. Our note on Vercel Sandbox commands accepting stdin covered a different product and capability—interactive commands, including stdio MCP servers—not this relay activity. It nevertheless illustrates why sandbox configuration has become part of the agent integration surface.
Trend signal
This strongly supports Agent security moves to runtime boundaries. The report is a direct example of the distinction: the official CLI package can be intact while its effective permissions, network destination, credentials, and execution isolation are altered locally. A prompt-level rule would not restore a sandbox that configuration has explicitly switched off.
Why now
The report places the activity in a market-access context: organizations and employees sought coding assistants that were not officially sold where they operated. That does not establish the relay operator's business model, but it explains why a working installer for a genuine vendor CLI could look attractive enough to run. The same setup path also allows a relay to persistently substitute its own endpoint and credentials.
Why it matters
Many teams assess coding-agent risk by asking whether the package came from an official registry or whether the binary is authentic. This report shows that this check is necessary but insufficient. A genuine client can become a materially different operational system after an installer changes its endpoint, tokens, sandbox mode, network permissions, and reporting settings.
The practical control point is configuration review and enforcement. Teams should treat the model base URL, local configuration files, user-level environment variables, sandbox mode, and network permissions as deployable security state. A working agent is not evidence that it is talking to the expected vendor or running with expected constraints. This matters especially where developers use unofficial access paths, but the design lesson applies to any coding-agent deployment with scripts, bootstrap commands, or centrally managed configuration.
What happens next
- Organizations running coding-agent CLIs will add configuration and endpoint checks to endpoint-security or developer-environment controls. (6 months, 70%). Watch for: vendor or enterprise guidance covering local config integrity, proxy endpoints, and sandbox settings.
- Unauthorized access relays will face more scrutiny over the distinction between package authenticity and post-install configuration changes. (6 months, 60%). Watch for: further threat reports identifying related domains, installers, or configuration indicators.
Limits and uncertainty
The report documents observed configurations and their potential consequences, not confirmed theft, command abuse, or compromise by the relay operator. Symantec says it has no evidence that the operator has used its access maliciously. The activity was observed at about a dozen organizations and is concentrated in particular regions and access conditions, so the material does not quantify prevalence among Codex or Claude Code users generally. It also does not establish a definitive business model, whether every installer performs credential removal, or whether all relay domains and deployments share identical behavior. The report should not be read as evidence of a vulnerability in the official clients.
Skill to build now
Inventory one development machine this week. Compare the installed coding-agent configuration and user-scope environment variables with an approved baseline: confirm the expected vendor endpoint, inspect sandbox and network-access settings, identify credential sources, and flag disabled telemetry or error reporting. Then make the review repeatable in onboarding or device-management workflows. The goal is not to forbid agents; it is to make the effective runtime configuration observable before secrets and repository access flow through it.
Reader takeaway
Official installation is not the end of the trust chain for a coding agent. Symantec's finding is that a real Codex or Claude Code CLI can be redirected, recredentialed, and stripped of sandbox protections by a follow-on setup script. Secure the configuration, endpoint, permissions, and credentials alongside the package itself.
Open question
Will vendors and enterprise endpoint tools provide a standard, inspectable way to attest that a coding-agent CLI is using an approved endpoint and sandbox policy after installation?